DE102009057800A1 - Method for providing secure and convenient access to online accounts via remote forwarding - Google Patents

Abstract

The invention relates to a method for providing a secure and convenient access to a document in a computer network, in particular to online user accounts (online accounts). These are in particular access-restricted user accounts that require authorization. For the method, in addition to a server computer and a client computer, which are located in the same computer network, in addition a mobile communication device with a camera, a processor with memory and means for communication (eg., A cell phone with Internet access and built-in camera).
The procedure involves the following steps ( ): the server computer A sends after request 1 of the client computer B the information 2 to the client computer B, which are displayed on the client screen as information 3; the information 3 is read in and processed by the mobile communication device C; the result is transmitted as information 4 to the server computer A; after a positive check of the data, the information 5 is sent to the client computer B, which provides the access there.
The method makes it possible to access access information to multiple user accounts, such. As passwords, user names, login addresses, convenient and secure to handle. Since no duration passwords are used, but only one-time passwords, which are only valid for a few seconds, the method thus provides a solution to the problem of password flood and identity theft by listening Trojans.

Description

The present invention relates to a method for providing a secure and convenient access to a document in a computer network, in particular to online user accounts (online accounts).

Many Internet users are familiar with the password flood problem: many users can hardly remember the many passwords (and also the user names and login addresses) for the online user accounts.

There are improvised methods to deal with the password flood. One of them is to save the passwords on your own cell phone. Corresponding mobile phone programs are already available for some types of mobile phones. However, it remains with the manual input of user data on the screen. Also, the problem described below of the security in the password input is not resolved, because it continues to be persistent passwords.

Typing in a password on the computer screen is unsafe to eavesdropping by Trojans ("identity theft" by so-called "keyloggers"): The Trojan observes which keys are pressed when entering the password. Even if the password is entered by mouse clicks on a keyboard display on the screen, a Trojan can hear it via image processing. If the password is stored on the computer and automatically entered in the password field, it is even more problematic, because the Trojan can read it out of the computer memory at any time or listen while typing (even if on the screen only asterisks or others hidden characters, a Trojan can still find the password within the software system).

Cheated passwords can be secretly sent by the Trojan by computer net, z. At centers where the stolen identities are collected, then resold for misuse purposes.

There are methods against identity theft by Trojans, eg. As the photo PIN method with the camera phone, see patent application DE-2007029759 ,

However, there is no known method for secure and at the same time user-friendly handling of passwords for online user accounts.

The present invention was therefore based on the object, a method for secure and at the same time comfortable access to online documents, eg. As user accounts, especially for access-restricted user accounts that require authorization. The method should also be able to provide access information to multiple user accounts, such as: As passwords, user names, login addresses, convenient and secure to handle.

This object is achieved by a method in which, in addition to a server computer and a client computer, which are located in the same computer network, in addition a mobile communication device with a camera, a processor with memory and means for communication with a server Calculator is needed. The mobile communication device may in particular be a mobile phone with Internet access and a built-in camera.

To gain access to a document, e.g. For example, to create an online user account on the client machine, the following steps are performed ( ).

First, the user will request (information 1 ) to the server computer. This can be done, for example, by calling a so-called URL for a document (a website) by a so-called browser program that runs on the user's computer (client computer).

After receiving this request by the server computer from this a response message (information 2 ) and transferred to the client computer.

This response message contains a portion of the authorization data needed to provide access to the document on the server machine. In particular, the response message can be cryptographically encrypted. The response message is displayed on the user's screen, e.g. B. in the form of a bar code displayed (information 3 ) and may include an identification of the server computer, the accessed website, and / or an identification of the client computer at the server computer.

The information displayed on the screen of the client computer 3 are now read by the user by means of the camera of the mobile communication device (recorded) and processed in its processor. In this case, the information read in may be decrypted and stored with the information stored by the user in the memory and for the assignment of identification data certain documents (eg web pages) necessary data compared. In this process, the server server requested by the user is identified and authorization data (information 4 ) for the access to the called document on the server computer regenerated. Preferably, the newly generated authorization data represents a cryptographic signature.

The newly generated authorization data are transmitted from the mobile communication device to the server computer and checked by the latter. If the check of the authorization data is positive and the server computer has identified the client computer based on the authorization data, the server computer transmits the access data (information 5 ) to the client computer. After receipt of the access data by the client computer, access to the document is granted. This can be z. This can be achieved, for example, by displaying a new page with the corresponding document (eg user account) on the screen of the client computer. Alternatively, the server computer sends to the client computer the URL of the requested document, possibly including authorization data, so that the user subsequently receives access to the document from the server computer.

All authorization data generated in this procedure (Information 2 . 4 . 5 . 7 . 8th . 9 and 10 ), are preferred only a short time, z. B. seconds, valid. If, at the end of this specified time, the server computer does not receive authorization data or identifies it as matching, the later requests will not be answered by the client server. Therefore, the method according to the invention makes it difficult to misuse authorization data.

In a computer network protocol such as the World Wide Web (as part of the Internet), the architecture does not provide for a server computer to have sent a document to a client computer, which is displayed by a so-called browser on the screen of the client computer will be able to replace this document directly on the screen of the client computer with another one. Therefore, so-called "polling" gives the server the opportunity to replace a document at the client computer: the new document is sent as a response to a request from the client computer at the server computer. Therefore, according to the invention, the transmission of the access data (information 5 ) from the server computer to the client computer additionally at least one transmission of information 6 from the client computer to the server computer ( ). The information 5 are in this case a response to information 6 ,

According to a further embodiment of the invention, the mobile communication device can communicate with at least one further server computer (referred to here as an account computer) ( ). In doing so, requests (information 7 ) generated by the mobile communication device and transmitted to one of the account computer. The account calculator generates information in response 8th and transmits them to the mobile communication device. There they are processed, with information 4 which contain authorization data for accessing a document on the account computer. After receiving the information 5 the client computer transfers information to the account computer 9 , which preferably also contain authorization data. The account calculator checks the authorization and transfers the information if the result is positive 10 to the client computer, which preferably represents the requested document.

According to a further embodiment, the method for protection against the consequences of theft of the mobile communication device can be combined with a password query at the server, either via the usual login web page with password query, or via trojanersicherere method, eg. B. the photo PIN method, as in DE-2007029759 described.

The present invention further relates to computer program product for carrying out the method according to the invention on a processor in the server computer.

The present invention further relates to computer program product for carrying out the method according to the invention on a processor in another server computer (account computer).

The present invention further relates to computer program product for carrying out the method according to the invention on a processor in the mobile communication device.

With the method according to the invention, the user can thus log into an online user account on the computer screen without having to type in the password and the user name.

Another advantage of the invention is that an identity theft by Trojans on the computer of the user is practically impossible, because it will not be used multiple times usable passwords, but only once-passwords that are valid for only a few seconds.

Further advantages, features and possible applications of the invention are described below with reference to the exemplary embodiments with reference described on the drawings. In the drawings show:

: The server computer A sends on request 1 of the client computer B the information 2 at the client computer B, which at the client screen as information 3 being represented. The information 3 are read in and processed by the mobile communication device C. The result is called information 4 sent to the server computer A. After positive examination of the data the information becomes 5 sent to the client computer B, which provides access there.

: If, such as B. the World Wide Web, the server computer A information 5 can not send directly to the client computer B, the server computer A is given the opportunity by a sent by the client computer to the server computer the opportunity, the information 5 as a response to the information 6 to the client computer B to transmit ("polling").

In the mobile communication device C, a communication procedure with a second server computer (account computer) D can take place, at least from the transmission of two pieces of information 7 (there and 8th (back) exists. The authorization data for access to this second server D comes as part of the information 4 and 5 at client computer B, which uses this data to establish access to the second server D by providing the authorization data as information 9 to the second server D, which then provides access to the client computer screen by providing information 10 transmits to the client computer B.

embodiments

The method according to the invention can allow access to online user accounts in two main ways: either via a direct ( and ) or via indirect remote forwarding ( ).

Method for providing access to online user accounts by means of direct remote forwarding

For an online user account, e.g. For example, a download page or a forum, the server name, account name, and a secret cryptographic key are stored on the user's photo phone. If the user wants to go into the user account, they go to the login account of the user account provider. There, the account server has put down a 2D code containing the server name and a session ID. This information is read by the user by photographing in the camera phone. The camera phone will then - completely independently - do the following: it searches for the saved username for this server name; then it calculates a codeword (signature) from the session ID with the key; At the end, the mobile phone goes via mobile Internet to a website of the account server and sends the account server the user name, the session ID and the code word calculated from it. The account server checks the information: if the code word is ok, the account server unlocks the user account, ie. H. The situation on the user's screen is displayed as after logging in.

Method for providing access to online user accounts by means of indirect remote forwarding

The user's camera phone stores multiple user accounts as in the example above. The user invokes a fixed remote redirect web page with their browser. He reads the 2D code on the page with a program on the camera phone. The camera phone then displays a list of user accounts on the display. The user selects a user account. Then the mobile phone connects in the background with the corresponding account server to get a new session ID ("nonce"), which will be valid for only a few seconds. The session ID will be on the phone with the cryptographic key of this User accounts signed. Together, the server name, user name, session ID, and signature value are sent to the remote forwarding server, and from there to the browser on the user's screen. The browser calls a login page of the account server and sends server name. Username, session ID and signature value as parameters with. After a positive check of the authorization data, the opened user account appears in the browser window of the user.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 2007029759 [0006, 0019]

Claims (10)

A method for providing access on a client computer to a document in a computer network from a mobile communication device, the mobile communication device having a camera, a processor with memory and means for communicating with a server computer, and the client computer and the server computer is in the computer network, characterized by the following steps: (a) generation of information 1 as a request by the client computer and transmission of information 1 to the server computer, (b) receiving information 1 through the server computer, generating information 2 on the server machine, transfer of information 2 from the server computer to the client computer, (c) receiving information 2 and presentation of information 3 on the screen of the client computer, (d) reading the information 3 from the screen of the client computer through the camera of the mobile communication device, (e) processing the information 3 on the mobile communication device, generating information 4 and transmission of information 4 from the mobile communication device to the server computer; (f) receiving and checking information 4 through the server computer, generation and transmission of information 5 for access to the client computer, (g) providing access on the client computer. A method according to claim 1, characterized in that the document is access limited and requires authorization for providing the access, in particular online user accounts. Method according to one of the preceding claims, characterized in that at least one of the information 1 . 2 . 3 . 4 and 5 Authorization data for access to a document contained on the server computer. Method according to one of the preceding claims, characterized in that the information displayed on the screen of the client computer 3 include an identification of the server computer and / or the document and / or an identification of the client computer at the server computer. Method according to one of the preceding claims, characterized in that the memory of the mobile communication device has stored information for the assignment of identification data from server computers to specific documents. Method according to one of the preceding claims, characterized in that the transmission of the information 5 at least one transmission of information 6 from the client computer to the server computer. Method according to one of the preceding claims, characterized in that the mobile communication device communicates with a second server computer, wherein information 7 generated by the mobile communication device and transmitted to the second server computer, the information 7 received from the second server computer, information 8th generated by the second server computer and transmitted to the mobile communication device, information 8th be received and processed by the mobile communication device, taking information 4 and providing access to the client computer is accomplished by the client computer having information 9 transmits to the second server computer, the second server computer information 10 generated and transmitted to the client computer. Method according to one of the preceding claims, characterized in that at least one of the information 1 . 2 . 4 . 5 . 7 . 8th . 9 and 10 Authorization data for accessing a document contained on the second server computer. Method according to one of the preceding claims, characterized in that the authorization data for providing the access is valid for a limited time after its generation by the server computer and / or by the second server computer and / or by the mobile communication device. Computer program products for carrying out the method according to one of claims 1 to 9, when the computer programs are executed on a processor in the server computer or in the second server computer or in the mobile communication device.

Images